This Privacy Policy explains how Noctium ("the app"), developed by Obelisk Agency, handles your information. We are committed to protecting your privacy and ensuring transparency about our data practices.
1. Data Collection
The app collects and stores the following data locally on your device:
- Your ebook and audiobook library (imported files, metadata, cover images)
- For books you read in place from a folder you choose, a reference to each file's location on your device. The app reads these files directly from your folder and never copies them off the device or transmits them.
- Reading progress, bookmarks, highlights, and annotations
- Reading statistics (time spent reading, pages read, streaks)
- App preferences (theme, font settings, playback speed, display options)
- Server connection details (URLs and credentials for self-hosted servers such as Calibre-Web, Kavita, and Audiobookshelf)
We do not create user accounts. No personal data is collected by Obelisk Agency unless you explicitly choose to use optional features described below.
2. Data Storage
All core app data is stored exclusively on your device using local databases and encrypted preferences. We do not operate servers that store your personal data.
3. Optional Google Drive Backup
If you choose to sign in with your Google account, the app can back up your reading progress and preferences to your Google Drive. This backup is stored in a private, app-specific folder that is invisible in your Google Drive and is automatically deleted if you uninstall the app or revoke access.
When you sign in, we access:
- Your Google account email address and display name (shown in the app to confirm which account is connected)
- Google Drive App Data scope (to read and write backup files only)
We do not access any other files on your Google Drive.
4. Third-Party Services
The app integrates the following third-party services:
- Google AdMob: Displays advertisements in the free version of the app (not shown on reading or audiobook playback screens). AdMob receives the Android Advertising ID (which you can reset or opt out of at the operating system level), coarse device information, and IP address, according to Google's Privacy Policy. In the European Economic Area, United Kingdom, and Switzerland, Noctium shows a Google-provided consent form (UMP) on first launch so you can decide whether personalized ads may use your data; you can change your choice at any time from Settings → Privacy & Data → Ad privacy options. You may remove all ads by purchasing the premium upgrade.
- Google Play Billing: Processes the in-app purchase for ad removal. We do not have access to your payment information.
- Firebase Crashlytics & Analytics: Collects anonymous crash reports and aggregate app-usage events (screen views, feature interactions) to help us fix bugs and improve stability. Data includes a Firebase Installation ID, device model, OS version, and crash stack traces; it does not include your library, bookmarks, highlights, or server credentials. You can disable crash reporting and analytics at any time from Settings → Privacy & Data → Share anonymous analytics & crash reports. Collection is always off in debug builds.
- Google Sign-In: Used only for Google Drive backup functionality. We only access your email address for display purposes and your Drive storage (App Data scope) for backup files.
5. Network Requests
The app makes network requests in the following scenarios:
- Project Gutenberg (OPDS): Browsing and downloading free public domain ebooks. Search queries and download requests are sent to gutenberg.org.
- LibriVox: Browsing and streaming free public domain audiobooks. Search queries are sent to librivox.org.
- Book metadata and cover images: When a book is missing a cover or description, the app searches for it by title and author. Queries are sent to the iTunes Search API (Apple), Google Books, and Open Library.
- Dictionary and word lookup: Looking up a word or phrase while reading. An offline dictionary is used first when available; otherwise the selected text is sent to dictionaryapi.dev for definitions, or to Wikipedia (wikipedia.org) for an encyclopedic explanation.
- KOReader progress sync (optional, off by default): If you enable KOReader sync, the app connects to a kosync-compatible sync server (a default public server, or one you self-host) to share your reading position across devices and apps. It sends your sync username, an authentication key derived from your password (never the password itself), a fingerprint of the book file, your reading progress, and your device model. Your credentials are stored in encrypted local storage.
- Self-hosted servers: If you configure connections to Calibre-Web, Kavita, or Audiobookshelf servers, the app communicates directly with those servers using the credentials you provide. Noctium uses HTTPS when your server supports it and also permits plain HTTP so you can connect to servers on your own local network that do not have a TLS certificate. Your credentials are stored in encrypted local storage regardless of transport and are never sent to Obelisk Agency.
6. Data Sharing
We do not sell, rent, or share your personal data with third parties. Data leaves your device only when you explicitly use features that require network communication (as described above) or through the third-party SDKs listed in Section 4.
7. Permissions
- Internet: Required for downloading books, streaming audiobooks, ads, crash reporting, and server connections.
- Storage / Media Audio (Android 12 and below): Required to import audiobook files from your device.
- Notifications: Used for audiobook playback controls and download progress.
- Foreground Service (Media Playback): Required to continue audiobook playback when the app is in the background.
- Wake Lock: Prevents the device from sleeping during audiobook playback.
8. Security
All communication with Google, Firebase, AdMob, and public third-party APIs uses HTTPS. Self-hosted server connections use HTTPS whenever the server supports it and plain HTTP only when you point Noctium at a non-TLS endpoint on your own network. Server credentials are kept in encrypted local storage regardless of transport. Google Drive backup data is transmitted over Google's encrypted channels.
9. Children's Privacy
Noctium is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
10. Your Rights
Access: All your data is stored locally and accessible to you at any time through the app.
Delete individual items: You can delete individual books, reading progress, or parts of your library at any time.
Delete everything (account deletion): Go to Settings → Privacy & Data → Disconnect & wipe all data. This signs you out of Google Drive, deletes every saved server and credential, clears all books stored in Noctium, along with bookmarks, highlights, reading stats, and preferences, and removes cached files. Books you read in place from a folder on your device are removed from the library, but their original files stay in your folder untouched. Uninstalling the app has the same effect on local data and also triggers Google to purge the Drive App Data backup folder.
Opt out of analytics & crash reporting: Toggle off Settings → Privacy & Data → Share anonymous analytics & crash reports.
Export: You can export your data via the backup feature in Settings.
Opt out of personalized ads: Change your UMP consent choice in Settings → Privacy & Data → Ad privacy options, or reset/opt out of the Advertising ID in your device settings, or purchase the premium upgrade to remove all third-party advertising.
Revoke backup: Sign out of Google Drive to stop cloud backups; revoking Noctium's Drive access in your Google account removes all remaining synced data.
For users in the European Economic Area (EEA), you have additional rights under the GDPR, including the right to access, rectify, and erase your data. Since all data is stored locally on your device, you exercise these rights directly through the app.
For users in California, you have rights under the CCPA/CPRA. We do not sell personal information. You may request deletion of your data by uninstalling the app.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last updated" date. Continued use of the app after changes constitutes acceptance of the updated policy.